From 70e6b1feb6e9d5e8121c9ce677ae2c3fb74a4237 Mon Sep 17 00:00:00 2001
From: Ondrej Kos <okos@redhat.com>
Date: Tue, 2 Oct 2012 18:56:39 +0200
Subject: [PATCH] Log possibly non-randomizable ccache file template

fixes https://fedorahosted.org/sssd/ticket/1533

ccache file template is now checked for appended XXXXXX for use with
mkstemp. When those characters are not present, warning is written to log.
---
 src/providers/krb5/krb5_auth.c  |  2 +-
 src/providers/krb5/krb5_utils.c | 24 ++++++++++++++++++++++--
 src/providers/krb5/krb5_utils.h |  3 ++-
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/src/providers/krb5/krb5_auth.c b/src/providers/krb5/krb5_auth.c
index a305bb69c24c022da1b33b2dd39baf16068b9406..36cbdb7c85159204ae8aef68cf2e94f793a8618f 100644
--- a/src/providers/krb5/krb5_auth.c
+++ b/src/providers/krb5/krb5_auth.c
@@ -100,7 +100,7 @@ check_old_ccache(const char *old_ccache, struct krb5child_req *kr,
         return EINVAL;
     }
 
-    ret = old_cc_ops->check_existing(old_ccache, kr->uid, realm,
+    ret = old_cc_ops->check_existing(kr, old_ccache, kr->uid, realm,
                                      kr->upn, active, valid);
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE,
diff --git a/src/providers/krb5/krb5_utils.c b/src/providers/krb5/krb5_utils.c
index 774f62dad092f54e979f887307b72f6ccdc4acbf..2bed77b5396a8948154b663dda672fe827897014 100644
--- a/src/providers/krb5/krb5_utils.c
+++ b/src/providers/krb5/krb5_utils.c
@@ -695,8 +695,25 @@ cc_residual_is_used(uid_t uid, const char *ccname,
     return EOK;
 }
 
+void
+cc_file_check_template(struct krb5child_req *kr)
+{
+    size_t ccname_len;
+    const char *ccname;
+
+    ccname = dp_opt_get_cstring(kr->krb5_ctx->opts, KRB5_CCNAME_TMPL);
+
+    ccname_len = strlen(ccname);
+    if (ccname_len >= 6 && strcmp(ccname + (ccname_len-6), "XXXXXX")==0 ) {
+        DEBUG(SSSDBG_CONF_SETTINGS, ("ccache file name template [%s] doesn't "
+                   "contain randomizing characters (XXXXXX), file might not "
+                   "be rewritable\n", ccname));
+    }
+}
+
 errno_t
-cc_file_check_existing(const char *location, uid_t uid,
+cc_file_check_existing(struct krb5child_req *kr,
+                       const char *location, uid_t uid,
                        const char *realm, const char *princ,
                        bool *_active, bool *_valid)
 {
@@ -723,6 +740,7 @@ cc_file_check_existing(const char *location, uid_t uid,
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active. "
                                   "Will create a new one.\n"));
+        cc_file_check_template(kr);
         active = false;
     }
 
@@ -844,7 +862,8 @@ get_ccache_for_princ(krb5_context context, const char *location,
 }
 
 errno_t
-cc_dir_check_existing(const char *location, uid_t uid,
+cc_dir_check_existing(struct krb5child_req *kr,
+                      const char *location, uid_t uid,
                       const char *realm, const char *princ,
                       bool *_active, bool *_valid)
 {
@@ -893,6 +912,7 @@ cc_dir_check_existing(const char *location, uid_t uid,
     if (ret != EOK) {
         DEBUG(SSSDBG_OP_FAILURE, ("Could not check if ccache is active. "
                                   "Will create a new one.\n"));
+        cc_file_check_template(kr);
         active = false;
     }
 
diff --git a/src/providers/krb5/krb5_utils.h b/src/providers/krb5/krb5_utils.h
index d8d96d25868b8896553455199043b3c23ff3686e..b9a24af9e558663051d1ca8b9ad9a178f1a09fce 100644
--- a/src/providers/krb5/krb5_utils.h
+++ b/src/providers/krb5/krb5_utils.h
@@ -35,7 +35,8 @@
 /* Operations on a credential cache */
 typedef errno_t (*cc_be_create_fn)(const char *location, pcre *illegal_re,
                                    uid_t uid, gid_t gid, bool private_path);
-typedef errno_t (*cc_be_check_existing)(const char *location, uid_t uid,
+typedef errno_t (*cc_be_check_existing)(struct krb5child_req *kr,
+                                        const char *location, uid_t uid,
                                         const char *realm, const char *princ,
                                         bool *active, bool *valid);
 typedef const char * (*cc_be_ccache_for_princ)(TALLOC_CTX *mem_ctx,
-- 
1.7.11.4

